Saturday, February 11, 2012

Apple is Stealing Address Books

from gizmodo.com

It's not really a secret, per se, but there's a quiet understanding among many iOS app developers that it is acceptable to send a user's entire address book, without their permission, to remote servers and then store it for future reference. It's common practice, and many companies likely have your address book stored in their database. Obviously, there are lots of awesome things apps can do with this data to vastly improve user experience. But it is also a breach of trust and an invasion of privacy.

I did a quick survey of 15 developers of popular iOS apps, and 13 of them told me they have a contacts database with millons of records. One company's database has Mark Zuckerberg's cell phone number, Larry Ellison's home phone number and Bill Gates' cell phone number. This data is not meant to be public, and people have an expectation of privacy with respect to their contacts.

There are two major questions to ask about this behavior:

First, why does Apple allow iOS apps to access a user's entire address book, at any time, without permission? Even Android requires that apps ask for explicit permission to access local contacts. On iOS, every other seemingly private local data source, like location and the camera roll, have strong protections; apps can't even see photos in the Camera Roll unless the user explicitly selects them from the image picker. There is a huge section of the Settings app dedicated to giving people fine control over which apps have access to location information. That Apple provides no protections on the Address Book is, at best, perplexing.

Second, why do app developers, who know of the potential public backlash if this behavior were publicized (that's why they keep it quiet), continue to upload user address books to their servers? I think this question is easier to answer. Any app is an investment, and, like any investment, there are three outcomes -- success, failure, and mediocrity. The only one that matters on a market like the App Store is success, so fledgling app developers do everything they can to increase their chances. Because Apple provides extremely easy access to address book data, the pro -- that is, using the data to improve user experience, increase virality and growth, etc. -- outweighs the con. To stay on equal footing, larger apps, like Yelp, Facebook, and Foursquare, have to follow along. From a design perspective, it is a concession of user growth at the expense of user trust.

Through the feedback we’ve received from all of you, we now understand that the way we had designed our ‘Add Friends’ feature was wrong. We are deeply sorry if you were uncomfortable with how our application used your phone contacts.

There was similar outrage last year, when Kik was outed. But, after a while, things calmed down. Kik never conceded. Developers continued to stay quiet. Users forgot about it entirely.

Apple's Failure

I fully believe this issue is a failure of Apple and a breach of trust by Apple, not by app developers. The expectation of Address Book privacy is obvious; in fact, one person on Hacker News, in response to learning about Path's use of the data, said, "Apple would never do this to their users." Because Apple has your trust and yet gives this private information freely to developers, Apple does do this to their users. All of them.

Usually, when I am curious about something Apple has done, I try to understand the design thinking that went into the decision. In this case, I can't think of a rational reason for why Apple has not placed any protections on Address Book in iOS. It makes no sense. It is a breach of my privacy, and it has allowed every app I've installed to steal my address book.

17 comments:

Correction: Apple is NOT "stealing address books". However, it is possible for an app to access your address book without asking your permission. This is explained in the article. A small difference, perhaps, but one that makes for a less sensational headline.

The only reason I can think of as to why Apple allows this is because it would be annoying to be asked every time an app needed to use an address. Even if access only needs to be enabled once per application, or per session, it makes things more complicated for the users. Huge sections of settings dedicated to highly granular security preferences are just the kind of thing that Apple hopes users should never have to deal with. I'll be curious as to how Apple responds to this issue

Um, no. All they would have to do is set it as a policy one time in their agreement with the publishers. If they violate the agreement, down comes the app. Simple. Besides, if the app NEEDS the data, why not use it only locally within the app. Surely the almighty Apple can handle that. Are all the app creators stupid or is that impossible in iOS?

I honestly don't know why an app developer would need to cache someone's entire address book on their server, and your suggestion of Apple having a strict policy sounds reasonable to me (perhaps the first reasonable thing you've written, except for the snarky tone). One problem is that detecting violations of this policy might be a little difficult, especially if the app developer was sneaky about it (for example. sending encrypted info piecemeal and at random times).

On another note, now that we have swapped user names so that I'm back to using my original un-trademarked name, people reading this blog's archived posts should have fun figuring out who wrote what.

Genius? That name alone is an insult to people with real intelligence. Ask one of those ass-clowns a technical question and they just stare at you. I wouldn't trust them to install a browser for me let alone fix something for me. Tech wanna-be's.

I think we all know that Apple didn't mean that the "Genius Bars" were actually manned by certified geniuses. But compared to most customers, those techs DO know a hell of a lot about troubleshooting problems with Apple products. While no doubt there are exceptions, by and large they do a good job. Apple's customer service is highly rated and the Genius Bar at the Apple Store is one of the reasons for that.

Haters, of course, will desperately latch on to anything (and I mean anything at all) to criticize Apple. Use of the term "genius" will do nicely. Hell, they make fun of the name of the company (as if that had anything to do with the actual products). It's pathological.

Come on, you know Apple people usually think they're better than everyone. I guarantee you that if you put the highest level Apple tech against the highest level Windows or Linux tech, it would be a joke. The Apple guy would be made to look like a fool. You could not possibly disagree with that.

"We are deeply sorry" you busted us. We'll try again later with a cooler app that you just HAVE to have.

I get irritated every time I start to download a Droid app, and my Droid tells me the thing wants access to more of my account than I like to share... and I kill the download/install. I get irritated. But not at my Droid. A the app vendor.

The problem with fanboys is that they just cannot possibly in any way live without that indistinct notion of cool in the next app...

Well, I'm far from "broke", I just have better things to spend my money on. Every person I have ever asked (Apple owner or not) has said that Apple is very pricey. My wife is smart enough to not purchase a $500 coach bag because the one she got for $50 looks great, lasts a long time and does the same function, sometimes better. It's a similar mentality with tech. Some people want to pay for that little Apple logo on the back because it makes them feel better. Be honest, why would they charge more for something that does the same or less?

Your analogy of Apple products with handbags is quite an exaggeration. (Typical hater bullshit) Apple products are NOT ten times more expensive than the competition. And technical products are NOT similar enough to each other to be treated as commodities, There are qualitative differences in the use of these products that often justify any price difference (at least in the purchaser's opinion).

There is a saying: It is a fool who knows the price of everything but the value of nothing.

If Apple owners are happy, what's the problem. If you like your non-Apple gear, good for you too. Different strokes.

Hey, I just said it was a "similar mentality" I never said they were the exact same thing. Not typical hater bs either. Apple fanboys spew the BS about a magical Apple experience, I just like to state facts.

Sure, SOME people pay extra just for the Apple logo, but if so, they are they are just as foolish is the uninformed drones that blindly buy Windows PCs for no other reason than that everyone else seems to use them. (They aren't called lemmings for nothing).

Personally, I prefer Apple gear because I understand and appreciate the design decisions Apple makes. Their products work for me with a minimum of fuss, and I don't mind paying a little more for the satisfaction I get. I wouldn't call them magical, but I think my iPhone and Macbook Air are pretty great.

I wish that more people would spend the time to really understand what sets various products apart, but many people are ignorant and lazy and tend to follow trends. I feel sad when I see some of the johnny-come-lately Apple customers that don't even appreciate what sets Apple products apart. They buy Apple for the wrong reasons.

Still, if the products didn't deliver the goods, Apple wouldn't be experiencing the steady phenomenal growth it has.